Constrained Automata: A Formal Tool for Risk Assessment and Mitigation,Journal of Informationa Assurance and Security, 2008